hackney EUVD-2026-109833

Exploitation requires a specific non-default setup: the application must use hackney over an HTTP CONNECT proxy, must configure a proxy_auth_fun callback, the proxy must return a 407, AND the callback must derive its returned binary from untrusted data such as the proxy's challenge headers (not static credentials). Attacker influence therefore depends on controlling or MITM-ing the proxy responses. Limiting factors: callbacks returning static credentials are not attacker-influenced; other CONNECT-path values (target host, request headers) were already checked for control bytes; and version 4.9.0 fully remediates by rejecting CR/LF/NUL values. Affected versions: hackney from 2.0.0 before 4.9.0.

Low real-world priority. The input CVSS 4.0 base score is 2.1 and the vuln.today decision label is 'monitor', not act_now or emergency. No EPSS score is provided, the CVE is not listed in CISA KEV, and no public exploit or PoC reference is present (only the fix PR/commit). All severity signals are therefore consistent and low. One conflict to verify: the supplied vector uses AV:L (local), yet the description states the malicious value is attacker-influenced via the proxy's 407 challenge headers, which is a network-sourced data path - AV:L reads as a config/operator-model choice rather than a true local-only trigger, so verify the attack-vector intent with the vendor/CNA. Exploitability is further gated by a non-default precondition (a proxy_auth_fun callback that derives its return value from untrusted data), making this a targeted, configuration-dependent integrity issue rather than a widespread threat.

An Erlang/Elixir application uses hackney through an HTTP CONNECT proxy and configures a proxy_auth_fun that builds the Proxy-Authorization value from the proxy's 407 challenge headers. A malicious or man-in-the-middle proxy returns a challenge whose header values embed CR, LF or NUL bytes; on the CONNECT retry hackney writes that value unchecked, so the attacker-chosen bytes add extra header lines to the request sent to the proxy. No public exploit is identified at time of analysis.